tag.yml

---
name: Tagged Releases

on:
  push:
    tags:
      - "v*"  # Only tags starting with "v" for "v1.0.0", etc.
  pull_request:
    types:
      - closed
    paths:
      - CHANGELOG.md

jobs:
  get_version_tag:
    name: Extract version from tag
    runs-on: ubuntu-24.04
    if: github.event_name == 'push'
    outputs:
      version: ${{ steps.get_version_tag.outputs.version }}

    steps:
      - name: Checkout code
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2

      - name: Extract tag name
        id: get_version_tag
        run: echo "version=${GITHUB_REF#refs/tags/v}" >> "$GITHUB_OUTPUT"

      - name: Ensure changelog was rendered
        run: |
          test "${{ steps.get_version_tag.outputs.version }}" = "$(python tools/version.py)" && \
          test -z "$(find changelog -type f -not -name '.*' -print -quit)"

  close_autopr_on_tag:
    name: Close release PR on manual tag
    runs-on: ubuntu-24.04
    if: github.event_name == 'push'
    needs:
      - get_version_tag

    steps:
      - name: Find Pull Request
        uses: juliangruber/find-pull-request-action@2f36c5fe1abfda4745dfab4f38217ebad8ded4eb  # v1.9.0
        id: find-pull-request
        with:
          branch: release/auto
          base: ${{ github.event.repository.default_branch }}
          state: open

      - name: Close release PR
        if: steps.find-pull-request.outputs.number != ''
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          gh pr close \
            --comment "This release was triggered manually as v${{ needs.get_version_tag.outputs.version }}" \
            --delete-branch \
            --repo "$GITHUB_REPOSITORY" \
            "${{ steps.find-pull-request.outputs.number }}"

  get_version_pr:
    name: Extract version from merged release PR
    runs-on: ubuntu-24.04
    permissions:
      contents: write  # To push the new tag. This does not cause a tag event.

    # Only trigger this on closed pull requests if:
    #   - The originating branch is from the same repository as the one running this workflow.
    #   - The originating branch is called `release/auto`
    #   - The PR was merged, not just closed.
    #   - The PR targeted the default branch of the repository this workflow is running from.
    if: >-
      github.event_name == 'pull_request' &&
      github.repository == github.event.pull_request.head.repo.full_name &&
      github.head_ref == 'release/auto' &&
      github.event.pull_request.merged == true &&
      github.base_ref == github.event.repository.default_branch

    outputs:
      version: ${{ steps.get_version_pr.outputs.version }}

    steps:
      - name: Checkout code
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2

      - name: Extract version of merged release PR
        id: get_version_pr
        run: echo "version=$(python tools/version.py)" >> "$GITHUB_OUTPUT"

      - name: Ensure no news fragments are left
        run: test -z "$(find changelog -type f -not -path '*/.*' -print -quit)"

      - name: Check extracted version matches PR title
        env:
          TITLE: ${{ github.event.pull_request.title }}
        run: >-
          [[ "$TITLE" == "Release v${{ steps.get_version_pr.outputs.version }}" ]] || exit 1

      - name: Create tag for release
        uses: mathieudutour/github-tag-action@d28fa2ccfbd16e871a4bdf35e11b3ad1bd56c0c1  # v6.2
        with:
          github_token: ${{ github.token }}
          custom_tag: ${{ steps.get_version_pr.outputs.version }}
          create_annotated_tag: true

  call_central_workflow:
    # Only call the central workflow if either of the above jobs report success.
    if: >-
      always() &&
      (
        needs.get_version_tag.result == 'success' ||
        needs.get_version_pr.result == 'success'
      )
    needs:
      - get_version_tag
      - get_version_pr
    uses: ./.github/workflows/ci.yml
    with:
      deploy-docs: true
      release: true
      version: ${{ github.event_name == 'push' && needs.get_version_tag.outputs.version || needs.get_version_pr.outputs.version }}
    permissions:
      contents: write
      id-token: write
      pages: write
      pull-requests: write
    secrets: inherit